XSS prevention in templates in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely display a user input variable in a Flask template.

Flask

{{ [1] }}

Drag options to blanks, or click blank then click option'

Araw

Buser_input

Cescape

Dsafe

Attempts:

3 left

💡 Hint

Common Mistakes

Using safe or raw without understanding they disable escaping.

Not using double curly braces to output variables.

In Flask templates, using {{ user_input }} automatically escapes the content to prevent XSS.

2fill in blank

medium

Complete the code to mark a string as safe and prevent escaping in a Flask template.

Flask

{{ user_input | [1] }}

Drag options to blanks, or click blank then click option'

Auser_input

Bsanitize

Csafe

Descape

Attempts:

3 left

💡 Hint

Common Mistakes

Using escape which actually adds escaping.

Using sanitize which is not a Flask template filter.

Using | safe tells Flask not to escape the string, so it renders as raw HTML.

3fill in blank

hard

Fix the error in the template code to properly escape user input.

Flask

{{ [1] }}

Drag options to blanks, or click blank then click option'

Asafe

BMarkup

Craw

Duser_input

Attempts:

3 left

💡 Hint

Common Mistakes

Using safe or raw which disables escaping and causes XSS risk.

Using Markup without understanding it disables escaping.

Using just {{ user_input }} ensures Flask auto-escapes the content to prevent XSS.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that escapes user inputs in Flask.

Flask

{% set escaped = {key: value | [1] for key, value in user_data.items() if value [2] ''} %}

Drag options to blanks, or click blank then click option'

Aescape

Bsafe

C !=

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using safe which disables escaping.

Using == instead of != causing wrong filtering.

Use | escape to escape values and != to filter out empty strings.

5fill in blank

hard

Fill all three blanks to safely render user input with a default fallback in Flask template.

Flask

{{ ([1] or [2]) | [3] }}

Drag options to blanks, or click blank then click option'

Auser_input

B''

Cescape

Dsafe

Attempts:

3 left

💡 Hint

Common Mistakes

Using safe filter which disables escaping.

Not providing a fallback value causing errors.

Use user_input or empty string '' and apply escape filter to prevent XSS.